RUSTSEC-2026-0119None▾ SunlitCPU exhaustion during message encoding due to O(n²) name compression
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
During message encoding, hickory-proto's BinEncoder stores pointers to
labels that are candidates for name compression in a Vec<(usize, Vec<u8>)>.
The name compression logic then searches for matches with a linear scan.
A malicious message with many records can both introduce many candidate labels, and invoke this linear scan many times. This can amplify CPU exhaustion in DoS attacks.
This is similar to CVE-2024-8508.
We recommend all affected users update to hickory-proto 0.26.1 for the fix.
hickory-proto >= 0.3.1, < 0.26.1Upgrade to a patched release:
hickory-proto 0.26.1Connected by shared product, vendor, weakness, or advisory.